REMARKS/ARGUMENTS 



Claims 1-18 are pending. Claims 12, 17, and 18 are amended. Support for the amendments to 
claims 12, 17, and 18 can be found in the specification on page 14, lines 24-27. No new matter is added. 

I. 35 U.S.C. § 101: Asserted Non-Statutory Subject Matter 

The examiner rejected claims 12, 17, and 18 under 35 U.S.C. § 101 as directed towards non- 
statutory subject matter. Applicants have amended these claims accordingly to recite a tangible medium. 
Therefore, this rejection is overcome. 

II. 35 U.S.C. § 103: Asserted Obviousness 
II.A. Claims 1-8 and 10-12 

The examiner rejects claims 1-8 and 10-12 as obvious under 35 U.S.C. § 103 over Holvey, et al, 

Method and System for Protecting Information on a Computer System . U.S. Patent Application 

Publication 2004/0054935 (March 18, 2004) (hereinafter "Holvey") in view of Prihoda, et al, Secure 

Data Processing Method . U.S. Patent 6,789,195 (September 7, 2004) (hereinafter "Prihoda"). This 

rejection is respectfully traversed. The examiner states that: 

6. Regarding claims 1, 11 and 12: Holvey discloses a data processing system 
(Title), method (Title), and an executable computer program on a tangible 
medium ([0038] software), respectively, for controlling access of at least one 
user to stored data comprising: 

means, responsive to a request from the user to access a set of the stored data that 
is available to the at least one user, for authenticating the user ([0022] requesting 
user authenticated via voice-print or ID and password); and 

a user specific table associated with the user (patient medical records and 
associated authorized users), wherein the user specific table identifies the set 
([0023]-[0024] Table 1). 

Holvey does not disclose decrypting the user specific table or accessing the set in 
response to successful decryption. 

Prihoda discloses means, responsive to successful authentication, for decrypting 
a user specific table associated with the user (col. 1,11. 57-65, storage.. . data.. . 
decrypted.. .); and means, responsive to successful decryption, for accessing the 
set (col. 2, 1 1. 15-20, authorized data access with key...). 

As one of ordinary skill in the art at the time of the invention would know, 
encrypting documents has been well-known since long before the invention. 
Therefore, it would have been obvious to one of ordinary skill in the art at the 
time of the invention to modify Holvey by encrypting and decrypting data as 
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taught by Prihoda in order to maintain confidentiality of users' information, (see 
Prihoda col. 2 11. 15-16). 

Office action of July 3 1 , 2007, pp. 4-5 (emphasis in original). 

The Examiner bears the burden of establishing a prima facie case of obviousness based on prior 
art when rejecting claims under 35 U.S.C. § 103. In re Fritch, 972 F.2d 1260, 23 U.S.P.Q.2d 1780 (Fed. 
Cir. 1992). The prior art reference (or references when combined) must teach or suggest all the claim 
liMtations. In re Royka, 490 F.2d 981, 180 USPQ 580 (CCPA 1974). In determining obviousness, the 
scope and content of the prior art are. . . determined; differences between the prior art and the claims at 
issue are. . . ascertained; and the level of ordinary skill in the pertinent art resolved. Against this 
background the obviousness or non-obviousness of the subject matter is determined. Graham v. John 
Deere Co., 383 U.S. 1 (1966). "Often, it will be necessary for a court to look to interrelated teachings of 
multiple patents; the effects of demands known to the design community or present in the marketplace; 
and the background knowledge possessed by a person having ordinary skill in the art, all in order to 
determine whether there was an apparent reason to combine the known elements in the fashion claimed 
by the patent at issue." KSR Int'l. Co. v. Teleflex, Inc., No. 04-1350 (U.S. Apr. 30, 2007). "Rejections on 
obviousness grounds cannot be sustained by mere conclusory statements; instead, there must be some 
articulated reasoning with some rational underpinning to support the legal conclusion of obviousness. 
Id. (citing In re Kahn, 44 1 F.3d 977, 988 (CA Fed. 2006))." 

II.A.1. The Proposed Combination Does Not Teach or Suggest All of the Features of Claim 1 

Applicants first address the rejection of claim 1 . Claim 1 is as follows: 

1 . (Previously Presented) A data processing system for controlling access 
of at least one user to stored data, the data processing system comprising: 

means, responsive to a request from the user to access a set of the stored 
data that is available to the at least one user, for authenticating the user; 

means, responsive to successful authentication, for decrypting a user 
specific table associated with the user, wherein the user specific table identifies 
the set; and 

means, responsive to successful decryption, for accessing the set. 

The examiner has failed to state a prima facie obviousness rejection against claim 1 because the 
proposed combination of the references, when considered as a whole, does not teach all of the features of 
claim 1 . Specifically, the proposed combination, considered as a whole, does not teach the features of, 
"means, responsive to successful authentication, for decrypting a user specific table associated with the 
user, wherein the user specific table identifies the set," as required by claim 1. 

Referring to, "patient medical records and associated authorized users," (Office action of July 31, 
2007, p. 4) the examiner relies on Holvey to teach this claim feature. Specifically, the examiner asserts 
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that the following portions of Holvey, in conjunction with the examiner's assertion, teach this claim 

feature (Applicants address the Prihoda portion of the combination further below): 

[0023] In the preferred embodiment of the present invention the security system 
supports multiple levels of user access. The owner of the medical records, 
identified as the patient, has the most complete set of rights. The patient can 
create users with surrogate rights. With the exception of access to certain 
information designated as private by the patient, surrogate users have the same 
access rights as the patient. In addition to read access to the medical records, the 
patient and surrogate user have write access to selected portions of the patient's 
medical and configuration records. Both the patient and surrogate users have the 
right to create additional users. The other three types of users are the provider 
that has write access to selected portions of the patient's medical and 
configuration records, the provider that does not have such write access, and the 
limited user. The surrogate, provider, and limited users have read access rights to 
all medical records except the records that the patient has designated as private 
records or as records not available to certain levels of user access. Table 1 below 
summarizes the access rights of each type of user to the patient's medical records. 
The users for each access level in Table 1, i.e., patient, surrogate, provider with 
write access, provider without write access, and limited, are all considered 

authorized users. 



[0024] The time during 
which a patient's medical 
records are accessible on- 
line, i.e., the access 
period, is scheduled by 
voice and menu-based 
telephone instructions to 
a service provider's fully 
automated voice 
recognition unit (VRU) 
or service provider agent. 
The patient and the surrogate user can schedule access periods for all users in 
Table 1 . The provider can schedule his/her own access period. Access periods for 
limited-rights users are available only when scheduled by a patient or a surrogate 
user. Note that a patient's medical records are not on-line during the entire access 
period, but only need to be on-line when an authorized scheduled user is logged 
into the Internet Web Server. 

Holvey, paragraphs 0023, 0024, and Table 1. 

As explained in the prior pre-appeal brief request, the examiner's assertions regarding these 
teachings vis-a-vis claim 1 are clearly erroneous. The cited portion of Holvey plainly does not teach 
suggest the claim feature of, "means, responsive to successful authentication, for decrypting a user 
specific table associated with the user, wherein the user specific table identifies the set," as specified 
claim 1 . In fact, nothing in Holvey teaches or suggests this claim feature. 



Level 2 
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A plain reading of paragraphs 23 and 24 shows that no basis exists to assert that the patient 
medical records are a "user specific table." The information may relate to specific users, but Holvey is 
completely silent on how the information is stored. Holvey simply does not state or imply that the 
information is in the form of a user specific table and Holvey gives no hint or suggestion that the 
information should be stored in a user specific table. 

Holvey does provide a "table" in the form of table 1. However, table 1 describes "the access 
rights of each type of user to the patient's medical records." Thus, table 1 refers to an exemplary set of 
access rights belonging to types of users. Holvey does not refer to user specific tables, but rather to types 
of users. Additionally, and even more importantly, Holvey does not state and does not give any hint or 
suggestion that table 1 is actually stored in the form of a user specific table. Holvey does not describe 
how the information is stored at all. In light of the fact that, in the art, such information is usually stored 
in massive relational databases or object oriented databases, no reasons exists to assume that the rights 
shown in table 1 are stored in a user specific table. Thus, Holvey does not teach or suggest the claimed 
feature of, "means, responsive to successful authentication, for decrypting a user specific table associated 
with the user, wherein the user specific table identifies the set." 

Additionally, Prihoda also does not teach or suggest this claimed feature. Instead, the plain 
disclosure of Prihoda directly contradicts the examiner's assertions . Prihoda specifically states that 
users access a centralized database. See Prihoda, col. 1, 11. 57-65 (the very portions of Prihoda cited by 
the examiner). Thus, Prihoda does not decrypt a user specific table, as asserted by the examiner, but 
rather teaches the opposite - a centralized database. 

Accordingly, the examiner appears to have ignored the plain teachings of Prihoda when 
fashioning the rejection. Ignoring the plain teachings of Prihoda fails to comport with the requirements 
of KSR Int'l. to look to the interrelated teachings of the art. For this reason, the examiner failed to state a 
prima facie obviousness rejection against claim 1. 

As shown above, neither Prihoda nor Holvey teach or suggest all of the features of claim 1 . For 
this reason, the proposed combination of references, considered as a whole, does not teach or suggest all 
of the features of claim 1 . For this reason also, under the standards of In re Royka, the examiner failed to 
state a prima facie obviousness rejection against claim 1 . 

II.A.2. The Examiner Failed To State a Proper Reason To Achieve the Legal Conclusion of 
Obviousness under the Standards of KSR Int'l 

Additionally, the examiner failed to state a prima facie obviousness rejection against claim 1 
because the examiner failed to state a proper reason to achieve the legal conclusion of obviousness under 
the standards of KSR Int 7. Regarding a reason to combine the references, the examiner states that: 
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As one of ordinary skill in the art at the time of the invention would know, 
encrypting documents has been well-known since long before the invention. 
Therefore, it would have been obvious to one of ordinary skill in the art at the 
time of the invention to modify Holvey by encrypting and decrypting data as 
taught by Prihoda in order to maintain confidentiality of users' information, (see 
Prihodacol. 211. 15-16). 

Office action of July 31, 2007, p. 4. 

However, the examiner's statement self-evidently does not satisfy the requirements of KSR Int'l. 
The Court in KSR Int 7. states that, "Often, it will be necessary for a court to look to interrelated teachings 
of multiple patents; the effects of demands known to the design community or present in the marketplace; 
and the background knowledge possessed by a person having ordinary skill in the art, all in order to 
determine whether there was an apparent reason to combine the known elements in the fashion claimed 
by the patent at issuer KSR Int'l. Co. v. Teleflex, Inc., No. 04-1350 (U.S. Apr. 30, 2007). "Rejections on 
obviousness grounds cannot be sustained by mere conclusory statements; instead, there must be some 
articulated reasoning with some rational underpinning to support the legal conclusion of obviousness. " 
Id. (citing In re Kahn, 441 F.3d 977, 988 (CA Fed. 2006))." 

In the case at hand, the examiner makes only a conclusory statement that provides no articulated 
reasoning and provides no rational underpinning to support the legal conclusion of obviousness. Instead, 
the examiner only states that the combination would be obvious "in order to maintain confidentiality of 
users' information." 

The examiner's statement is conclusory because the examiner provides no connecting logic 
between the asserted advantage and the legal conclusion of obviousness. For similar reasons, the 
examiner's statement provides no rational underpinning to support the legal conclusion of obviousness. 
The examiner only states a purported advantage to combine the references. However, the examiner does 
not provide any technical or other rational connection between the purported advantage and the legal 
conclusion of obviousness. Instead the examiner simply states the purported advantage and then assumes 
that the reader would recognize that the purported advantage would somehow compel the legal 
conclusion that claim 1 is obvious in view of the references. However, this assumption fails to comport 
with the requirements of KSR Int 7 that the examiner provide articulated reasoning with a rational 
underpinning to achieve the legal conclusion of obviousness in view of the references. 

As a specific example that applies to the case at hand, the "idea" of encrypting information, and 
databases, has existed for decades. However, despite the value of the claimed inventions, no one of 
ordinary skill has produced the claimed inventions or produced a product including the claimed 
inventions. Had a reason existed to combine the references to achieve the invention of claim 1, someone 
would already have made the claimed invention. Therefore, no reason whatsoever exists to connect the 
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advantage of encryption/ decryption with Holvey in such a manner that compels the legal conclusion that 
claim 1 is obvious. This example shows that when the logical gaps between the examiner's statement and 
the legal conclusion of obviousness are examined, the opposite conclusion arises - that claim 1 is non- 
obvious in view of the references considered as a whole. 

In any case, the examiner's statement is both conclusory and provides no articulated reasoning 
with some rational underpinning to support the legal conclusion of obviousness. Accordingly, under the 
standards of KSR Int 1, the examiner failed to state a prima facie obviousness rejection against claim 1 or 
any other claim. 

11. A.3. Both Holvey and Prihoda Teach Away from the Invention of Claim 1 

In addition, the examiner has failed to establish a prima facie obviousness rejection against claim 
1 because no proper reason exists under the standards of KSR Int 7. to combine the references in the 
manner suggested by the examiner. No proper reason exists to combine the references exists because 
both Holvey and Prihoda teach away from claim 1 . 

As described above, both Holvey and Prihoda provide for techniques of working with centralized 
databases. In stark contrast, claim 1 requires use of a user-specific table. Thus, one of ordinary skill 
would immediately recognize that both Holvey and Prihoda are wholly inappropriate to the method 
described in claim 1 . Additionally, when considering these references as a whole, one of ordinary skill 
would be motivated to avoid combining the references in a manner that results in a user specific table, 
because these references tout the advantages of maintaining a centralized database. 

For this reason, both Holvey and Prihoda teach way from the method of claim 1 . Accordingly, no 
proper reason exists to combine the references to achieve the legal conclusion of obviousness, as required 
by KSR Int 7. Indeed, a strong motivation exists to avoid combining the references to achieve the claimed 
invention, which recites a user-specific table, because the references tout the advantages of maintaining a 
centralized database. Therefore, under the standards of KSR Int 7. , the examiner has failed to state a 
prima facie obviousness rejection against claim 1. 

n.B. Claim 9 

The examiner rejects claim 9 under 35 U.S.C. § 103 as obvious over Holvey, Prihoda, and 
Chadwick, Smart Cards Aren't Always the Smart Choice . IEEE Computer, December 1999, v. 32, issue 

12, pp. 142-143 (hereinafter "Chadwick"). This rejection is respectfully traversed. The examiner states 
that: 

8. Regarding claim 9: Holvey discloses a token ([0022]). Holvey does not 
disclose the token comprising the means for decrypting. Prihoda discloses a 
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token comprising the means for decrypting (Abstract and col. 2, 1 1. 15-20, key 
for decrypting). 

As one of ordinary skill in the art at the time of the invention would know, 
software tokens have been well-known since long before the invention, (see 
Chadwick, p. 142, col. 1-2, regarding public/private key infrastructure software 
tokens). Therefore, it would have been obvious to one of ordinary skill in the art 
at the time of the invention to modify Holvey by encrypting and decrypting data 
as taught by Prihoda in order to maintain confidentiality of users' information, 
(see Prihoda, col. 3 11.20-21). 

Office action of July 31, 2007, pp. 5-6 (emphasis in original). 

The rejection of claim 9 relies on the combination of Holvey and Prihoda. Therefore, the 
examiner failed to state a prima facie obviousness rejection against claim 9 for the same reasons the 
examiner failed to state a prima facie obviousness rejection against claim 1. 

Additionally, Chadwick adds nothing to the combination of Holvey and Prihoda regarding the 
claimed feature of, "means, responsive to successful authentication, for decrypting a user specific table 
associated with the user, wherein the user specific table identifies the set." Chadwick is directed towards 
describing the advantages and disadvantages of "smart cards." Chadwick is wholly devoid of disclosures 
regarding user specific tables. Therefore, the combination of Holvey, Prihoda, and Chadwick does not 
teach or suggest all of the features of the claims. Accordingly, under the standards of In re Royka, the 
examiner failed to state a prima facie obviousness rejection against claim 9. 

Additionally, vis-a-vis the requirement of a rational reason to arrive at the legal conclusion of 
obviousness, the examiner engages in the same conclusory reasoning that fails to comport with the 
requirements of KSR Int 7. The examiner believes, again, that obviousness is compelled simply by virtue 
of the existence of the advantage to "maintain confidentiality of users' information." However, the 
examiner fails to cite any reason to connect this purported advantage to compel the legal conclusion of 
obviousness. Accordingly, the examiner failed to state a prima facie obviousness rejection against claim 
9. 

Furthermore, the examiner's statements are overly broad to serve as a proper reason to combine 
the references to achieve the legal conclusion of the obviousness of claim 1 . Under the examiner's 
reasoning any reference that deals with computer security could be combined with Holvey to achieve the 
legal conclusion of obviousness. This fact shows that the examiner's statements fail to comport with the 
standards of KSR Int 7. Accordingly, again, the examiner failed to state a prima facie obviousness 
rejection against claim 9. 
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n.C. Claims 13-18 

The examiner rejects claims 13-18 under 35 U.S.C. § 103 as obvious over Holvey, Prihoda, and 

Mita et al., Medical Data Sharing Method and Medical Data Sharing System Using the Method , U.S. 

Patent Application Publication 2002/0035485 (March 21, 2002) (hereinafter "Mita"). This rejection is 

respectfully traversed. The examiner states that: 

10. Regarding claims 13, 15 and 17: Holvey discloses additional user specific 
tables for each additional user ([0007] patient database, i.e., collection of patient 
tables). 

Mita discloses means for attempting to decrypt, in turn, each of the user specific 
tables until a successful decryption occurs ([0042] sequential search). 

As one of ordinary skill in the art at the time of the invention would know, 
sequential searching has been well-known since long before the invention. 
Therefore, it would have been obvious to one of ordinary skill in the art at the 
time of the invention to modify Holvey by sequential searching as taught by Mita 
in order to access stored personal including medical data (see Mita, Title). 

Office action of July 31, 2007, p. 6 (emphasis in original). 

The rejection of claim 13 relies on the combination of Holvey and Prihoda. Therefore, the 
examiner failed to state a prima facie obviousness rejection against claim 13 for the same reasons the 
examiner failed to state a prima facie obviousness rejection against claim 1. 

Additionally, Mita adds nothing to the combination of Holvey and Prihoda regarding the claimed 
feature of, "means, responsive to successful authentication, for decrypting a user specific table associated 
with the user, wherein the user specific table identifies the set." Mita is directed towards a method of 
sharing medical information over a network. Mita is wholly devoid of disclosures regarding user specific 
tables. Therefore, the combination of Holvey, Prihoda, and Mita does not teach or suggest all of the 
features of the claims. Accordingly, under the standards of In re Royka, the examiner failed to state a 
prima facie obviousness rejection against claim 13 or the remaining claims. 

Additionally, vis-a-vis the requirement of a rational reason to arrive at the legal conclusion of 
obviousness, the examiner engages in the same conclusory reasoning that fails to comport with the 
requirements of KSR Int 7. The examiner believes that obviousness is compelled simply by virtue of the 
existence of the advantage of accessing stored personal data including medical data. However, the 
examiner fails to cite any reason to connect this purported advantage to compel the legal conclusion of 
obviousness. Accordingly, the examiner failed to state a prima facie obviousness rejection against claim 
13. 
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The subject application is patentable over the cited references and should now be in condition for 
allowance. The examiner is invited to call the undersigned at the below-listed telephone number if in the 
opinion of the examiner such a telephone conference would expedite or aid the prosecution and 
examination of this application. 



DATE: October 3 1,2007 

Respectfully submitted, 



/Theodore D. Fav 111/ 

Theodore D. Fay 11 1 
Reg. No. 48,504 
Yee & Associates, P.C. 
P.O. Box 802333 
Dallas, TX 75380 
(972) 385-8777 
Attorney for Applicants 
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